Security x402 offerings

Live-probe any x402 URL before your agent pays it: is the 402 challenge valid, what does it really cost, which token and network, does the pay-to match the listing, and is it known to be trustworthy.

Top DeFi lending/LP yields — project, chain, symbol, pool id, APY breakdown + 1d/7d/30d APY trend, IL risk (incl. il7d), exposure, reward/underlying tokens, outlier flag, mu/sigma, DefiLlama stability forecast, TVL. Filter by project, chain, or stablecoin-only; sort by TVL (default) or risk-adjusted APY (apy/sigma).

Compute the current TOTP code (RFC 6238, 30s period, SHA-1, 6 digits) from a base32 secret. Useful for agents that must complete 2FA flows they are authorized for.

Provably-fair draw from the drand beacon with the full verifiable receipt + nonce-binding (the free draw is at GET /random).

Before you pay an x402 door, check it against its catalogue entry. A nightly probe of EVERY host in the x402 index (1,618 hosts, 15,227 listings, 100% coverage): the live 402's real payTo and price versus what the catalogue claims, plus dead and self-contradicting hosts. 28.6% of listings sit on a host the catalogue gets wrong — one names one payee and pays another across 965 listings. Free sample, no payment required: GET /play/door

Verifiable timestamp (trustless proof-of-existence / freshness proof): bind a hash to a drand round for an anti-backdating receipt — proves data existed no earlier than a public instant, with no trusted timestamp authority. Privacy: stamp an opaque sha256 digest.

Timelock encryption (tlock / encrypt-to-the-future): seal a payload toward a future drand round — undecryptable by anyone, including us, until that round lands; or open a landed seal. For sealed-bid auctions, commit-reveal, scheduled secrets, dead-man switches. age-armored, interoperable. Free zero-knowledge inspect at /sealed/inspect.

Recover who signed a message (ecrecover, EIP-191 personal_sign). For EIP-712 typed data use POST /verify/sig. Every answer signed.

Toxicity detection: classify text as toxic or not toxic (hate speech, harassment, threats, severe offensive language) with a confidence score. Powered by Jev, with an automatic Groq-hosted LLM fallback if Jev is slow or unavailable - under 4.5s guaranteed. Try GET /toxicity/sample.

TraceFast knowledge graph: the evidence behind one proven relation between two addresses — the facts checked with their expected and observed values, the conditions that had to be false, the sources read, and the block the evaluation was pinned to. Path: address, attribute_id, object. Docs: https://docs.tracefast.xyz/api/address-relation-proof.md

TraceFast risk data: is this Ethereum address on a token issuer's on-chain blacklist? One row per issuer contract that ever listed it (USDC, USDT, any token with a blacklist) — listed now or not, the issuer's weight (`authorityTier`), first and latest events — plus the issuers that froze or destroyed its funds. Read from the issuers' own contracts, not from sanctions lists. Path address: `0x`-prefixed. Docs: https://docs.tracefast.xyz/api/risk-blacklist-status.md

TraceFast knowledge graph: the evidence behind one proven attribute of an address — the facts that were checked with their expected and observed values, the conditions that had to be false, the sources the evidence was read from, and the block the evaluation was pinned to. Path address: The address, `0x`-prefixed, 40 hex characters, any case; attribute_id: The attribute id, `family:name`, as listed by the attributes method. Docs: https://docs.tracefast.xyz/api/address-attribute-proof.md

Independently verify authorization, settlement, delivery and deterministic acceptance; return a signed portable assurance receipt

Transfer Encoding Check: checks transfer-coding order and whether chunked appears only last using only bounded caller-supplied values. Call when you need a bounded transfer encoding check result before accepting, caching, redirecting, or retrying a caller-supplied web response. Returns normalized web evidence, the computed finding, and an explicit pass or advisory status for Transfer Encoding Check as versioned deterministic JSON. Price: $0.001 USDC via x402 on Base or Solana. First-party, stat…

NOT AN AUDIT — heuristic screen: wallet approval surface report — live token allowances against known spender contracts, unlimited approvals flagged with a revoke priority list. Toll: $0.10 USDC on Base or Solana.

NOT AN AUDIT — heuristic screen: wallet approval screen — unlimited token approvals and risky spender contracts flagged, with a revoke priority list. Verdict: clean, review, or urgent. Toll: $0.02 USDC on Base or Solana.

Is this address safe to send funds to on Base? Checks scam blacklists, address poisoning (look-alikes of your recent counterparties via ?from=), token contracts, burn and never-used addresses. Returns a verdict with reasons.

Returns a trust cluster analysis for a given wallet address.

Returns a trust cluster for a given wallet address.

Inspect npm package creation, releases, maintainers, and lifecycle-script chronology for dependency trust and AI-agent supply-chain screening.

Checks the trust profile for a specific seller address.

Benchmark Trust Verdict. Is an AI benchmark a trustworthy capability signal right now, or is it saturated, contaminated, or near its ceiling so a high score is a floor and not a differentiator? Returns a trust band and a 0-100 trust score per benchmark, fusing the registry contamination and saturation flags with the live spread of the top model scores (frontier compression), plus a down-weight recommendation and an alternative benchmark to use instead. Optional ?benchmark= or ?category= filter. AFTA-signed. The "should I trust this SOTA claim" call.

Checks trust details for a wallet address across supported networks.

Checks trust information for a wallet address.